https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-24000.htmlhttps://patchthecve.com/cve/CVE-2024-24000.htmlWed, 17 Jun 2026 07:14:00 +0000CRITICAL 9.8: jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths.https://patchthecve.com/cve/CVE-2024-0491.htmlhttps://patchthecve.com/cve/CVE-2024-0491.htmlWed, 17 Jun 2026 06:53:37 +0000MEDIUM 5.3: A vulnerability classified as problematic has been found in Huaxia ERP up to 3.1. Affected is an unknown function of the file src/main/java/com/jsh/erp/controller/UserController.java. The manipulation leads to weak password recovery. It is possible to launch the attack remotely. Upgrading to versionhttps://patchthecve.com/cve/CVE-2024-0490.htmlhttps://patchthecve.com/cve/CVE-2024-0490.htmlWed, 17 Jun 2026 06:53:37 +0000MEDIUM 5.3: A vulnerability was found in Huaxia ERP up to 3.1. It has been rated as problematic. This issue affects some unknown processing of the file /user/getAllList. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may bhttps://patchthecve.com/cve/CVE-2023-48894.htmlhttps://patchthecve.com/cve/CVE-2023-48894.htmlWed, 17 Jun 2026 06:35:07 +0000MEDIUM 6.5: Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter function.